{"id":"CVE-2026-62182","kind":"vulnerability","aliases":["CVE-2026-62182","GHSA-m3c6-2p7h-cfr3","GO-2026-6573"],"related":[],"title":"KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedge","description":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","summary":"KubeEdge's ConfigUpdateJob handler builds a shell command from user-supplied updateFields values without escaping, so shell metacharacters run as commands. An attacker who can create or edit a ConfigUpdateJob runs arbitrary commands on the enrolled edge node with the privileges of the KubeEdge process.","severity":"high","cvss":8.8,"epss":0.00476,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/kubeedge/kubeedge","fixed":["1.21.2","1.22.2","1.23.1"],"affected":">= 1.23.0, < 1.23.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["edge-nodes","go","kubeedge","kubernetes","package"],"not_affected_if":["version-1.21.2-or-later","version-1.22.2-or-later","version-1.23.1-or-later","version-below-1.21.0"],"how_to_check":"Check the KubeEdge version on edge nodes and the control plane with the kubeedge version command or the image tag in use.\nList ConfigUpdateJob resources with kubectl get configupdatejobs -A and review who can create or update them.","fix":"Upgrade to KubeEdge 1.21.2, 1.22.2, or 1.23.1 depending on the release line in use.\nUntil patched, restrict create and update permissions on ConfigUpdateJob resources to trusted users.","status":"open","published_at":"2026-09-21T18:17:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:43:56+00:00","updated_at":"2026-10-23T21:43:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:43:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to KubeEdge 1.21.2, 1.22.2, or 1.23.1 depending on the release line in use.\nUntil patched, restrict create and update permissions on ConfigUpdateJob resources to trusted users.","reach":"network","impact":"high","summary":"KubeEdge's ConfigUpdateJob handler builds a shell command from user-supplied updateFields values without escaping, so shell metacharacters run as commands. An attacker who can create or edit a ConfigUpdateJob runs arbitrary commands on the enrolled edge node with the privileges of the KubeEdge process.","category":"package","who_cares":["kubeedge","kubernetes","go","edge-nodes"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs arbitrary shell commands on edge nodes as the KubeEdge process user.","analyst_note":"Confirm which RBAC roles can write ConfigUpdateJob and whether the advisory at https://pkg.go.dev/vuln/GO-2026-6573 lists a detection method or workaround beyond the upgrade.","how_to_check":"Check the KubeEdge version on edge nodes and the control plane with the kubeedge version command or the image tag in use.\nList ConfigUpdateJob resources with kubectl get configupdatejobs -A and review who can create or update them.\nunknown","needs_analyst":true,"not_affected_if":["version-below-1.21.0","version-1.21.2-or-later","version-1.22.2-or-later","version-1.23.1-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3116,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A,30A '-62182':20A,31A '-6573':28A '/kubeedge/kubeedge':17A,34A '1.21.0':106C '1.21.2':108C,184C '1.22.2':109C,185C '1.23.1':111C,187C '2p7h':24A 'applic':98C 'arbitrari':74B,158C 'attack':65B 'authent':117C 'build':46B 'capabl':100C 'caus':157C 'cfr3':25A 'code':9A 'command':49B,63B,75B,129C,159C 'complet':153C 'concaten':116C 'config':127C 'config-upd':126C 'configupdatejob':2A,44B,72B,112C,145C 'container':97C 'control':120C 'creat':68B,142C 'cve':18A,29A 'edg':12A,36B,79B,104C,166C 'edge-nod':35B 'edge/pkg/taskmanager/actions/configupdatejob.go':115C 'edit':70B 'enabl':4A 'enrol':78B,164C 'escap':57B 'execut':10A,131C,161C 'extend':95C 'fix':181C 'ghsa':22A 'ghsa-m3c6-2p7h-cfr3':21A 'github.com':16A,33A 'github.com/kubeedge/kubeedge':15A,32A 'go':26A,38B 'handl':175C 'handler':45B 'host':102C 'includ':148C 'inject':7A 'issu':179C 'job':177C 'keadm':125C 'kubeedg':1A,39B,42B,86B,88C,173C 'kubernet':40B 'm3c6':23A 'metacharact':60B,150C 'modifi':144C 'nativ':96C 'node':13A,37B,80B,167C 'open':91C 'orchestr':99C 'packag':41B 'permiss':140C 'privileg':83B,170C 'process':87B,113C,174C 'remot':5A 'resourc':146C 'run':61B,73B 'set':154C 'shell':6A,48B,59B,136C,149C 'sourc':92C 'suppli':53B 'system':93C,135C 'target':165C 'updat':128C 'updatefield':3A,54B,121C 'user':52B,119C,138C 'user-control':118C 'user-suppli':51B 'valu':55B,122C,155C 'version':183C 'without':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T18:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6573","url":"https://pkg.go.dev/vuln/GO-2026-6573","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62182","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62182","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62182","severity":null,"published_at":"2026-09-21T18:17:09+00:00","modified_at":"2026-09-24T23:17:13+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}